#398

backend/app/services/preview/http_fetcher.rb

@@ -28,11 +28,29 @@ module Preview
           raise FetchFailed, 'redirect が多すぎます．'
         end
 
-        raise FetchFailed, 'redirect 先が不正です．' if location.blank?
+        if location.blank?
+          log_failure(:blank_redirect_location,
+                      url: uri.to_s,
+                      redirects:,
+                      content_type: response['content-type'],
+                      content_length: response['content-length'])
+          raise FetchFailed, 'redirect 先が不正です．'
+        end
 
-        return fetch(URI.join(uri, location).to_s,
-                     max_bytes:,
-                     redirects: redirects - 1)
+        redirect_url =
+            begin
+              URI.join(uri, location).to_s
+            rescue URI::InvalidURIError => e
+              log_failure(:invalid_redirect_location,
+                          url: uri.to_s,
+                          redirects:,
+                          location:,
+                          error: e.class.name,
+                          message: e.message)
+              raise FetchFailed, 'redirect 先が不正です．'
+            end
+
+        return fetch(redirect_url, max_bytes:, redirects: redirects - 1)
       end
 
       unless response.is_a?(Net::HTTPSuccess)

backend/app/services/preview/thumbnail_fetcher.rb

@@ -1,6 +1,9 @@
 module Preview
   class ThumbnailFetcher
     class GenerationFailed < StandardError; end
+    ALLOWED_IMAGE_CONTENT_TYPES = [
+      'image/jpeg', 'image/png', 'image/gif', 'image/webp'
+    ].freeze
     HTML_MAX_BYTES = 1.megabyte
     NICONICO_XML_MAX_BYTES = 256.kilobytes
 
@@ -32,7 +35,7 @@ module Preview
       return nil if url.blank?
 
       response = HttpFetcher.fetch(url)
-      return nil unless response.content_type.downcase.start_with?('image/')
+      return nil unless allowed_image_content_type?(response.content_type)
 
       response.body
     rescue HttpFetcher::FetchTimeout
@@ -43,7 +46,7 @@ module Preview
 
     def self.fetch_image!(url)
       response = HttpFetcher.fetch(url)
-      unless response.content_type.downcase.start_with?('image/')
+      unless allowed_image_content_type?(response.content_type)
         raise GenerationFailed, 'サムネール画像が見つかりませんでした．'
       end
 
@@ -80,7 +83,13 @@ module Preview
       nil
     end
 
+    def self.allowed_image_content_type?(content_type)
+      mime_type = content_type.to_s.split(';', 2).first.downcase.strip
+      ALLOWED_IMAGE_CONTENT_TYPES.include?(mime_type)
+    end
+
     private_class_method :fetch_image_or_nil, :fetch_image!,
-                         :niconico_thumbnail_url
+                         :niconico_thumbnail_url,
+                         :allowed_image_content_type?
   end
 end

backend/app/services/preview/url_safety.rb

@@ -40,6 +40,8 @@ module Preview
       end
 
       [uri, parsed_addresses.map(&:to_s)]
+    rescue Resolv::ResolvError
+      raise UnsafeUrl, 'URL のホストを解決できません．'
     rescue URI::InvalidURIError, IPAddr::InvalidAddressError
       raise UnsafeUrl, 'URL が不正です．'
     end